OL
Vendor
OliveTin
17
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-53541 | OL OliveTin OliveTin | 4.3 | Aug 21 | OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering |
| CVE-2026-67439 | OL OliveTin OliveTin | 4.3 | Jul 29 | OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output |
| CVE-2026-67438 | OL OliveTin OliveTin | 6.6 | Jul 29 | OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check |
| CVE-2026-67437 | OL OliveTin OliveTin | 7.5 | Jul 29 | OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth) |
| CVE-2026-48709 | OL OliveTin OliveTin | 3.7 | Jun 15 | OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration |
| CVE-2026-48708 | OL OliveTin OliveTin | 7.5 | Jun 15 | OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination |
| CVE-2026-32102 | OL OliveTin OliveTin | 6.5 | Mar 11 | OliveTin Unauthorized Action Output Disclosure via EventStream |
| CVE-2026-31817 | OL OliveTin OliveTin | 8.5 | Mar 10 | OliveTin's unsafe parsing of UniqueTrackingId can be used to write files |
| CVE-2026-30233 | OL OliveTin OliveTin | 4.3 | Mar 6 | OliveTin: View permission not being checked when returning dashboards |
| CVE-2026-30225 | OL OliveTin OliveTin | 4.3 | Mar 6 | OliveTin: RestartAction always runs actions as guest |
| CVE-2026-30223 | OL OliveTin OliveTin | 8.8 | Mar 6 | OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes |
| CVE-2026-30224 | OL OliveTin OliveTin | 5.4 | Mar 6 | OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session |
| CVE-2026-28790 | OL OliveTin OliveTin | 7.5 | Mar 5 | OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login |
| CVE-2026-28789 | OL OliveTin OliveTin | 7.5 | Mar 5 | OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling |
| CVE-2026-28342 | OL OliveTin OliveTin | 7.5 | Mar 5 | OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint |
| CVE-2026-27626 | OL OliveTin OliveTin | 9.9 | Feb 25 | OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks |
| CVE-2025-50946 | OL Olivetin Olivetin | 6.5 | Aug 13 | OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go |